63 lines
1.8 KiB
HCL
63 lines
1.8 KiB
HCL
resource "random_password" "frigate_s3" {
|
|
length = 48
|
|
special = false
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "frigate_s3" {
|
|
mount = vault_mount.secret.path
|
|
name = "versitygw/users/model-reader"
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({
|
|
accessKeyId = "model-reader"
|
|
secretAccessKey = random_password.frigate_s3.result
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "frigate_oauth2_proxy" {
|
|
mount = vault_mount.secret.path
|
|
name = "frigate/oauth2-proxy"
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "frigate_oauth2_proxy_cookie" {
|
|
mount = vault_mount.secret.path
|
|
name = "frigate/oauth2-proxy-cookie"
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({})
|
|
}
|
|
|
|
resource "vault_policy" "frigate" {
|
|
name = "frigate"
|
|
|
|
policy = <<-EOT
|
|
path "secret/data/frigate/rtsp" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "secret/data/frigate/oauth2-proxy" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "secret/data/frigate/oauth2-proxy-cookie" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "secret/data/quay/robots/cluster_pull" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "secret/data/versitygw/users/model-reader" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "pki/cert/ca" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "frigate" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "frigate"
|
|
bound_service_account_names = ["frigate-vso"]
|
|
bound_service_account_namespaces = ["frigate"]
|
|
token_policies = [vault_policy.frigate.name]
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
}
|